Along with the many benefits of data and communication exchanges as a result of the Internet, there are significant risks. Providing security for a computer network so as to prevent disruption of network operations is an increasing concern for network administrators. A security measure that has become a standard practice is to use a firewall as a chokepoint for the network. The firewall enforces one or more sets of rules which determine access to and from nodes of the network.
Firewalls utilize various techniques to provide security for a network. One such technique is packet filtering. The firewall may examine packets to determine origins, destinations and content. All packets that violate a rule are discarded. As another technique, security measures may be applied at lower levels. Thus, there may be rules that are specific to determining whether to enable establishment of a Transmission Control Protocol (TCP) connection or a Universal Datagram Protocol (UDP) connection. In addition to providing rules that are specific to packet filtering or specific to types of connections, there are approaches that are specific to a particular application. As examples, there may be rules directed to a File Transfer Protocol (FTP) application, a Telnet application, HyperText Transfer Protocol (HTTP), or Simple Mail Transfer Protocol (SMTP).
Network security for a particular network may be provided by using a number of separate components. It is typical for the application-level firewall directed to electronic mail (email) to be a separate component. Thus, there may be a general firewall at the chokepoint of the network and an internal “spam filter” that applies security measures to email messages of the network. For network email messages having destinations or origins outside of the network, there may be different sets of rules applied at the spam filter and at the general firewall.
As used herein, the term “spam” is defined as unsolicited messages intended for bulk distribution. With respect to email, spam is a form of abuse of the SMTP. A spam email may be a mere inconvenience or annoyance, as is the case if the email includes advertisement. However, a spam email may also include a virus or a “worm” which is intended to affect operation or performance of a device or the entire network. At times, spam is designed to induce a person to disclose confidential personal or business-related information. Additionally, even unharmful spam is a financial drain to large corporations.
A commercial supplier of spam filters will often provide regular updates for the application of security rules. The supplier may operate a central location that identifies the need for updated rules and that has Internet access to spam filters located at different networks. A spam filter of a particular network may collect information regarding activity within the network. This activity may be useful to the centralized supplier for the purpose of identifying “events” which indicate the need for rule or definition updates. A concern is that if the reporting information must pass through one or more “chokepoint” firewalls to exit the network for transmission to the central facility, the transmission may be blocked. Because the different security devices are separately controlled, the “innocent” transmission may be interpreted as being a distribution of confidential data, for example. If the centralized facility is to have the ability to quickly identify and respond to an intrusive event, such as a widespread distribution of a virus or worm, reporting information must be allowed to pass from the network. This concern also applies to other network security devices that benefit from the ability of transmitting reporting data.